--- schema_version: "1" id: cf7ec5e4d46a04c3fa59916c65602a5572063a417a92ff520be0abd9b8a8cd70 title: Detection Event Is Definitely Anomalous but Maybe Not Malicious collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/real_time_em_threat_examples_anomalous.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.real_time_em_threat_examples_anomalous.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: fabdd1e50cb00f23401379963ed8dc36e71ba2be06024edba9092e3300fd11b7 description: Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, use her company’s VPN to log into Salesforce. products: - Salesforce Platform - Cross Cloud release: "264" --- # Detection Event Is Definitely Anomalous but Maybe Not Malicious Alice is a sales rep based in St. Louis. She’s often on the road to meet with clients. When she travels, she generally, but not consistently, use her company’s VPN to log into Salesforce. ### Required Editions
Available in both Salesforce Classic (not available in all orgs) and Lightning Experience.

Available in: Enterprise, Unlimited, and Developer Editions

Requires Salesforce Shield or Salesforce Event Monitoring add-on subscriptions.
On July 27, 2015, Alice’s account was used to generate a report from a relatively new IP address. Bob, the administrator for Alice’s org, noticed a ReportAnomalyEvent about this report generation activity. The event contained this information. | ReportAnomalyEvent Field | Value | | --- | --- | | Score | 95.0158 | | SourceIp | 96.43.144.27 | | EventDate | 2015-07-27T07:45:07.192Z | | UserId | 00530000009M944 | | Report | 00OD0000001leVCMAY | | SecurityEventData | (see next table) | The SecurityEventData field contained this information. | featureName | featureValue | featureContribution | | --- | --- | --- | | autonomousSystem | Softbank Corp | 73.4% | | rowCount | 50876 | 15.6% | | userAgent | \- | 9.9% | | numberFilters | 11 | 0.81% | | periodOfDay | Night | 0.21% | Bob notices that the autonomous system—derived from the IP address—is the top-ranked feature with 73.4% feature contribution. This percentage indicates that Alice rarely uses this autonomous system. Bob also notices that the report has around 50k rows, which is not small for this org. Bob then uses the UserId to identify the user as Alice. By looking at the ReportEvent events, Bob notices that Alice typically generates reports containing 1,000–10,000 rows. But on rare occasions, Alice generated reports with more than 50k rows. The userAgent has a smaller feature contribution, which could be attributed to Alice using her mobile device less when she travels. The numberFilters and periodOfDay features have small feature contributions, and are therefore not important. Because Alice rarely uses this autonomous system and the report is bigger than what Alice typically generates, Bob concludes that this report falls outside of typical activity. However, Bob is unable to verify whether Alice or an attacker committed this malicious act. He attempts to get more information on this incident before pursuing any threat mitigation actions. #### See Also - [_Platform Events Developer Guide_: ReportAnomalyEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportanomalyevent.htm) - [_Platform Events Developer Guide_: ReportEvent](https://developer.salesforce.com/docs/atlas.en-us.platform_events.meta/platform_events/sforce_api_objects_reportevent.htm)